Can Card Sales Be Diverted From Merchant Services

Let'south read the small impress together…

Accepting credit card payments at your business opens up a lot of doors. In doing and so, you'll stand to benefit from quicker, safer payments, a more streamlined sales process, and better customer service. You'll even attract a whole new generation of increasingly cash-phobic customers .

And then prepare to go acquainted with the credit card laws your business organisation needs to know about. Whether you're new to accepting credit card payments, or a veteran just looking to brush upwards on the nuts, our guide is a stress-complimentary, jargon-free route to complete credit card compliance . Scroll on to get started, or swoop into the listing below to jump straight to a specific section.

What you need to know:

PCI DSS: safeguards cardholder data when a payment is made online
The Durbin Subpoena: changed the fees merchants must pay in an online transaction
IRS Mandate (Section 6050W): Mandates the reporting of sales made with a credit or debit carte du jour to the IRS
PA-DSS: Ensures merchant POS (point of sale) systems are compliant

PCI Compliance

If y'all've already spent a bit of fourth dimension researching different merchant services providers, you'll have seen these iii letters popping up a lot . Only what do they mean?

PCI: The Basics

PCI is short for 'Payments Carte Industry'. The PCI is responsible for administering a strict set of rules, known as PCI DSS (Payments Card Industry Data Security Standards) . It'south an industry-wide group of guidelines defended to preventing fraud.

PCI DSS was ready upwards by the Data Security Council, a body fabricated up of the big credit card brands, including Mastercard, Visa, American Limited, and Find.
PCI compliance

PCI DSS credit card processing laws help safeguard the cardholder's data when a transaction takes place, and all merchants, financial institutions, payment processors, and merchant services providers are responsible for upholding them .

This is known equally PCI compliance.

PCI compliance doesn't just protect your customers, though – it'll protect your business from data breaches, and help you lot swerve the crippling cost of fraudulent transactions. Plus, not complying with PCI standards comes with big fines – meaning information technology's best to get wise to them sooner rather than later.

Then how do you achieve compliance?

How Do You Ensure Your Business organization Is PCI Compliant?

How you'll remain PCI compliant depends largely on the type of company you've chosen to process your credit card payments.

Dedicated (or traditional) merchant accounts fix with a depository financial institution or independent visitor may require you to take PCI compliance into your own hands. This involves validating your current information security standards by filling out a Cocky-Cess Questionnaire ( SAQ ) .

The PCI has nine different forms. Which one you must fill out is based on your transaction volume, and the method you use to accept credit card payments. It'due south your job to figure out (or rent someone to effigy out) which grade is relevant to you, and ensure it gets completed on an annual basis.

Based on how much you're processing, you'll be sorted into one of four 'levels' of compliance. Let'south accept a await:

The 4 Levels of PCI Compliance

PCI Level 1

For businesses that process more than than six 1000000 payments a year
Most expensive
Comes with hardware and software costs, plus the fees involved with grooming an internal auditor

Validation requirements

Annual Written report on Compliance (ROC) by a Qualified Security Assessor (QSA) or internal auditor
Quarterly network scan by an ASV
Attestation of Compliance course

PCI Level 2

For businesses that procedure between ane million and six 1000000 payments a year.

Validation requirements

Annual Self-Cess Questionnaire (SAQ)
Quarterly network scan past ASV
Attestation of Compliance Class

PCI Level 3

For businesses that take between twenty,000 and one 1000000 ecommerce payments annually.

Validation requirements

Annual SAQ
Quarterly network scan by ASV
Attestation of Compliance Form

PCI Level 4

For businesses that process up to 20,000 payments a year via ecommerce…
… or up to one million payments via other channels

Validation requirements

Annual SAQ recommended
Quarterly network scan past ASV, if applicable
Compliance validation requirements set by merchant banking company

PCI: The 3-Step Procedure

In that location's a whole other agglomeration of stuff involved with remaining compliant, too.

The PCI has a list of 12 standards , from mapping out your data flows and implementing firewalls, to encrypting (and tokenizing ) the manual of sensitive cardholder information .

Information technology's likewise of import to annotation that PCI compliance is an ongoing procedure; complying isn't a 1-fourth dimension matter, but a constant cycle of assessment and reporting .

PCI's '3-Step Process' serves every bit a expert guide to become going with:

Assess: Identifying cardholder data, taking an inventory of IT assets and business organization processes for payment carte du jour processing, and analyzing them for vulnerabilities.

REMEDIATE: Fixing vulnerabilities and eliminating the storage of cardholder data unless absolutely necessary.

REPORT: Compiling and submitting required reports to the appropriate acquiring depository financial institution and card brands.

Source: How to Secure With the PCI Data Security Standard

Basically, it's all very complicated – particularly for small businesses but starting out. Plus, though PCI DSS sets out important standards for merchants, information technology's not necessarily enough – i.east., it won't provide adequate protection for all payment environments. Is there an easier way?

Yes, there is. That'south why we recommend opting for a payment service provider that'due south completely PCI compliant .

Providers such as Square , Zettle (formerly iZettle), and Heartland Payment Systems provide you lot with payments infrastructure that already meets the PCI's strict standards , helping ease the brunt of compliance. Sure, some merchant account providers may charge for the privilege of a PCI compliant solution, only trust u.s. – in the long run, it's worth information technology. And it'due south amend than a hefty fine!

As PCI practiced Mike Dahn of Stripe says:

"Moving to a safer card credence method is a much more than effective way to protect your arrangement. The long-standing benefit this provides is that yous don't need to rely on industry baseline standards, or worry about the potential failure of security controls.

"This approach provides agile businesses a style to mitigate a potential data breach, and avoid the emotional, time-consuming, and plush historical approach to PCI validation."

The bottom line? Ensure you understand exactly what your obligations are before signing a contract with a merchant services provider. Your payment service provider should always be able to talk you through which elements of PCI compliance are handled past them, and what (if anything) y'all'll need to practice on your end.

How Do Credit Bill of fare Processing Brands Remain PCI Compliant?

Before selecting a credit bill of fare processing visitor, you should starting time ensure you understand exactly what PCI compliance responsibilities volition be required of you, and what's handled by the provider.

Take a look at how three online payment providers approach PCI compliance beneath.

Square

Foursquare's carte du jour readers are equipped with stop-to-cease encryption, while Square's handles PCI compliance for all of its software on an ongoing ground. Foursquare as well deals with the banks and credit card processing institutions on your behalf, and advocates for your business in example of disputes. Most chiefly, Foursquare'due south networks, policies, and processes all adhere to PCI regulations – meaning your business concern' transactions are always covered, and at no actress cost to you.

Sage Pay

Sage Pay has the highest level of PCI compliance (Level 1). While this can reduce your own compliance requirements, that doesn't mean Sage Pay will accept care of PCI for you. Rather, Sage Pay recommends you speak to your merchant account provider (also known as an acquirer) to exist referred to a QSA. At the very least, yous'll have to fill up out an SAQ to appraise your own business' PCI requirements.

Helcim

Like Square, Helcim'southward platform is completely PCI compliant. You'll pay no PCI fees, and nothing for non-compliance, either. Better yet, Helcim allows you to generate your ain PCI compliance certificate at no cost, helping you to remain secure and safe in the optics of the (credit bill of fare processing) police.

The Durbin Amendment

The Durbin Amendment , part of the Dodd-Frank constabulary of 2010, slashed the amount that card associations were legally allowed to accuse for interchange fees on debit card transactions.

The idea was to lower retailer's costs, and ultimately drive downwards costs for the consumer, too.

Interchange fees, which averaged out at effectually $0.44 per transaction , were slashed more or less in half, existence capped at $0.22 + 5% per sale. Awesome, correct?

Well… not exactly. While it drove downwards fees, The Durbin Subpoena had unintended consequences for pocket-sized businesses. Considering, while the interchange rate was halved, the transaction fee was more than doubled . The result? Merchants averaging sales of $15 or less actually ended up paying more fees than they did before the Durbin Amendment came into forcefulness.

Basically, what The Durbin Amendment means for merchants is that yous'll actually stand up to save money if yous process a lot of card transactions, or deal mainly in higher value sales. For businesses with a lower average debit card transaction value, it may end up costing you more than.

What is adept, though, is that The Durbin Subpoena didn't bear upon smaller banks and credit unions , which got to sidestep the loss of revenue the big banks faced. This allowed smaller banks to keep fees low – ideal for new merchants looking to jumpstart their business with low credit card processing rates.

And then, how much does it really cost to accept credit and debit carte payments? Explore our complete guide to credit menu processing fees in the US to notice out.

IRS Mandate (Department 6050W)

We couldn't become through an article nigh rules and regulations without mentioning the IRS (Inland Revenue Service), now could we?

Nope. And hither's where Section 6050W comes in. According to the IRS…

"Section 6050W requires information returns to be made for each calendar year by merchant acquiring entities and 3rd party settlement organizations with respect to payments made in settlement of payment card transactions and 3rd party payment network transactions occurring in that calendar year."

Bleurgh.

In plain English, this ways merchants need to report their yearly gross transactions processed with a credit, debit, or co-branded carte to their merchant services provider.

This is then passed along to the IRS. It's kind of similar a revenue enhancement return, but for merchants accepting credit card payments.

PA-DSS

PA-DSS (Payment Application Information Security Standards) is another credit card processing police force y'all'll want to know about.

It's a rule mandating that any POS (Indicate of Sale) equipment or terminals must meet the PCI's gear up of standards.

There are two reasons why PA-DSS is adept news for merchants. First, PA-DSS compliant POS equipment helps you remain PCI compliant. Second? Meeting PA-DSS standards is entirely the POS system technology supplier'southward responsibility – not the merchant's.

Adjacent Steps

Similar many of the best things in life, credit card processing comes with rules, regulations, and laws. But you shouldn't see these as barriers to your business concern, or as restrictions dragging yous downwardly. Rather, they're there to keep your concern and your customers safe – to prevent fraud, reassure your patrons, and assistance you avoid large fines.

It's too important to remember that credit card processing regulations and rules aren't but a box to exist ticked, then you're done. Nope – fraudsters are constantly evolving, so the laws take to equally well . That means you lot'll need to examine your own cardholder data practices on an ongoing basis, to ensure that you lot're doing correct by your customers.

Talk to your payment service provider nearly what PCI requirements – if whatever – fall under the scope of your business' responsibilities. And again, if yous're in the process of choosing a merchant services provider, make sure you know exactly how PCI compliance is being handled, and what the costs involved will exist.

Jargon Buster

OK, so our guide wasn't completely jargon-free. No matter – you'll notice all the industry'southward most important (and most baffling!) acronyms beneath.

ASV (Approved Scanning Vendor): an organization which validates DSS requirements.

PA-QSA (Payment Awarding Qualified Security Assessor): organizations qualified by the Council to take their employees assess compliance.

PCI (Payments Carte Manufacture Information Security Standard): A strict listing of standards governing the storage and use of cardholder information. All merchants – that is, businesses accepting credit and debit card payments – must know how to comply.

PFI (PCI Forensic Investigator): establishes, then maintains rules and requirements regarding PCI eligibility.

QIRs (Qualified Integrators and Resellers): provide opportunity for eligible professionals of qualifying organizations to receive grooming and qualifications on secure installation security.

QSA (Qualified Security Assessor): employees of an organization qualified by the Quango.

SAQ (Self-Cess Questionnaire): a checklist provided by the PCI Security Standards Council for validating your own adherence to PCI requirements.

Rob Binns

Rob writes mainly near the payments industry, but also brings to the table manufacture-specific noesis of CRM software, business loans, fulfilment, and invoice finance. When not exasperating his editor with bad puns, he tin be found relaxing in a sunny (socially-distanced) corner, with a beer and a battered copy of Dostoevsky.